CyberCertPrepOT Security FundamentalsOT Fundamentals: Network Architecture & ProtocolsEASYFree question
An OT architect must decide where to place a patch/update staging server that downloads vendor patches from the internet and serves them to control-zone engineering stations. The appropriate placement is:
- A.On the corporate LAN with a route opened straight into the control zone so that patches reach controllers without traversing any staging tier
- B.On the same host as the safety controller to centralize updates
- C.In the Level 3.5 DMZ, where it can receive patches from outside and be polled by control-zone hosts without a direct internet path to OT
- D.Inside Level 1 next to the PLCs for quick deployment, which engineering workstations already enforce by signing every project file at save time
Why C is correct
A patch staging server is a broker: it pulls updates from the enterprise/internet side and control-zone hosts retrieve from it, all within the DMZ. This avoids giving control-zone systems any direct internet path.
Know someone studying for OT Security Fundamentals? Send them this one.